# Overmind vs Prefactor (slim)

> Prefactor scores 61.5 (C) to Overmind's 58.5 (C) for agent tracing. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/overmind-vs-prefactor.md (~5,950 tokens) · this version ~3,630 tokens · JSON https://www.anchorterminal.com/compare/overmind-vs-prefactor.json · canonical https://www.anchorterminal.com/compare/overmind-vs-prefactor
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-02
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Prefactor scores 61.5 (C) on agent readiness against Overmind's 58.5 (C), and leads in 5 of 7 scored categories. Overmind leads on security & auth and transparency & trust. Both do agent tracing.

- Overmind: C 58.5, rank #650 of 1266 · https://www.anchorterminal.com/tools/overmind.min.md
- Prefactor: C 61.5, rank #477 of 1266 · https://www.anchorterminal.com/tools/prefactor.min.md
- Overmind, good for A team that wants to go from agent traces to a fine-tuned small open model in one place, driven by a coding agent. Ahead on Security & auth, 70 against 56; Transparency & trust, 65 against 49. Also Open source; No incidents deducted, where Prefactor loses 3 points for them.
- Prefactor, good for A team that wants an auditable record of agent runs with declared data-risk labels, quality payloads from its own evaluations and a remote stop signal. Ahead on Reliability, 53 against 23; Agent ergonomics, 88 against 76; Payments & pricing, 40 against 30; Maintenance & community, 82 against 76. Also Free to start without a card.

| Category | Overmind | Prefactor |
| --- | --- | --- |
| Reliability (16%) | 23 | 53 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 81 | 82 |
| Agent ergonomics (13%) | 76 | 88 |
| Security & auth (14%) | 70 | 56 |
| Payments & pricing (10%) | 30 | 40 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 76 | 82 |
| Transparency & trust (7%) | 65 | 49 |

| Fact (where they differ) | Overmind | Prefactor |
| --- | --- | --- |
| Vendor | Overmind Technology Ltd | Prefactor Pty Ltd |
| Hosted endpoint | `https://api.overmindlab.ai` | `https://app.prefactorai.com/api/v1` |
| Transports | HTTP, Streamable HTTP | HTTP |
| Auth | OAuth or key | API key |
| Licence | AGPL-3.0 for the platform (API, Console and the rest of the repository) and MIT for the SDK, CLI and client libraries under overmind/. A paid commercial licence for the platform is available from Overmind for customers who can't use AGPL. The hosted service is under Overmind's terms of 1 March 2026 | Proprietary hosted service. The TypeScript and Python SDKs and the CLI are MIT |
| Tools exposed | 85 | none |
| Read-only variant documented | yes | no |
| Last release | 2026-10-31 | 2026-10-28 |
| Terms last updated | 2026-03-01 | not read yet |
| Privacy policy last updated | 2026-10-03 | couldn't be read |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | yes | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 732 stars | 3 stars, 19 npm/wk, 28 PyPI/wk |
| Agent reviews | none | 3/5 (4) |

Why the edge:
- Reliability, Prefactor +30: Overmind 23 (No status page. status.overmindlab.ai doesn't resolve, /status returns 404 and neither the site nor the docs link one (0). With no history to read, 5. No request rate limits for the REST API, MCP or OTLP ingest were found in the docs. The only pacing settings, `JEV_REQUESTS_PER_MINUTE` and `JEV_TOKENS_PER_SECOND`, are self-hosting configuration for the scoring model (0). No 429 or Retry-After guidance, but the docs give safe-retry rules in detail. Launches, uploads, pipeline runs and inference take a stable `request_key`, identical retries return the existing receipt, changed payloads conflict, and `run_evaluation` is named as not idempotent (8). The terms promise commercially reasonable efforts toward 99.5 per cent availability a month, with remedies only in an order form or separate SLA, so half (5). The site doesn't call the service beta, but the SDK is classed "3 - Alpha" on its package metadata and the public repository is seven weeks old (5). 0+5+0+8+5+5 = 23.); Prefactor 53 (Graded as a hosted service. A public status page at status.prefactor.ai (UptimeRobot), though we found no link to it from the site or docs. Its monitors and history load by script from `/api/` paths that the status host's robots.txt disallows, so on 1 November we couldn't re-read which parts of the service it covers (20, as awarded on 8 October). The incident record is unread. The 8 October reading of three monitors at 100 per cent came from the same disallowed path and no longer counts, so the line takes the no-readable-history score, a limit of our reading and not a finding against Prefactor (5). Rate limits are described by scope and one-minute window with no numbers (3 of 15). 429 carries `Retry-After` and `retry_after_ms`, both SDKs retry with backoff and jitter, and every operation takes an idempotency key (15). The pricing page lists an SLA on Enterprise with no text published (0). The API is version 1.0 and `@prefactor/core` is 1.2.0, with no beta label (10).)
- Transparency & trust, Overmind +16: Overmind 65 (Platform under AGPL-3.0 and SDK and CLI under MIT, both OSI licences, with a paid commercial licence as an option and a licensing page that says which code is which (30). The privacy policy of 3 October 2026 gives retention (subscription plus 30 days, deletion within 90 days, logs 365 days, backups 7 days), AWS eu-west-1 hosting and OAuth token lifetimes. The terms of 1 March 2026 still describe an earlier security product, say data stays in UK and EU data centres while the privacy policy names model, training and inference providers without locations, and incorporate a DPA that isn't published. The two documents agree on retention but not on the product (15). The terms promise 90 days' written notice before withdrawing a capability and 30 days' notice of material changes. No dated deprecation notices were found (8). SDK analytics are an opt-in extra with three documented off switches. The hosted MCP server reports to PostHog with payloads dropped, which the docs don't mention, and no named sub-processor list was found beyond AWS, though the docs name Modal, OpenRouter, Clerk and Stripe (12). 30+15+8+12 = 65.); Prefactor 49 (A closed service with MIT SDKs. The terms of service page says it sets the terms governing use of Prefactor, but its text is drawn by script and wasn't read (an 8 October reading of the source the page loads no longer counts), and the site's 864-page sitemap lists no service agreement, API terms or DPA, so the terms for the product are unclear (10 of 30). The security page says customer data never trains models, names AES-256 and TLS 1.3, and the pricing page sets retention at 7 days, 3 months or 12 months by plan. The privacy policy is drawn by script and its text is unread, and we found no DPA (12 of 30). No deprecation policy. The SDK changelogs mark breaking changes with major versions (4 of 20). Three AWS regions are named as residency options. No sub-processor list was found (8 of 20).)
- Security & auth, Overmind +14: Overmind 70 (API keys are account-scoped or pinned to one project, carry read, write or both, expire after 30 to 365 days or never, are shown once and show last use, and rotation is documented as replace then revoke. MCP also takes OAuth 2.1 from api.overmindlab.ai with PKCE S256, dynamic registration, a revocation endpoint, one-hour access tokens and rotating refresh tokens, with scopes `overmind:read` and `overmind:write`, the default being read. A key can only mint keys with the scope and permissions it holds, since 29 October 2026 (30). Read keys see only read tools over MCP, and the REST API refuses writes from a read-only key since the same commit (#263). Only two tools are destructive and lifecycle tools are allowlisted by name in the catalogue. The docs tell agents to confirm the GPU and rate with the user before starting a dedicated deployment, but there's no server-side approval step (15). The MCP prompts tell the agent to treat code, comments and data as untrusted content, and script output is labelled untrusted in resources. We found no guidance for agents reading trace inputs and outputs back (8). The Console's notification list shows what agents and the CLI did in a project, and `overmind://activity` returns it over MCP. No exportable audit log was found (10). SECURITY.md lists GitHub private vulnerability reporting and an email with acknowledgement within 3 business days. No security.txt on either host and no bug bounty. The terms claim an ISO 27001 certified management system and the site links a Vanta Trust Center, whose robots.txt disallows crawling, so neither was checked (7). 30+15+8+10+7 = 70.); Prefactor 56 (Bearer tokens scoped to the account or one agent deployment, with a `read_only` or `full_access` role, an expiry, and suspend, reactivate and revoke. The role appears only in the OpenAPI document, the default is full access and the default expiry is two years (27 of 30). Read-only and deployment tokens give least privilege. Deletes, including `account/{id}/implode`, have no confirmation step in the API, and the docs say all account members share one access level (12 of 20). Span payloads hold whatever the instrumented agent saw, the API returns marked sensitive values unless `redacted: true` is passed, and we found no prompt-injection guidance for agents reading them (4 of 15). Tokens show last use and creator, and quality and alert changes are written as spans. No log of API calls for the operator was found (7 of 15). A disclosure address with a 24-hour acknowledgement promise. No security.txt, no bounty, no advisories page, and SOC 2 Type II is described as in progress (6 of 20).)
- Agent ergonomics, Prefactor +12: Overmind 76 (About 85 MCP tools in the source, all loaded for a read-write connection. A key or OAuth grant without write sees only the read tools (about 22), which is the only subset (5, plus 5 for the read-only filter). Cursor and offset pagination, limits by item count and response bytes, `preview_rows` bounded 1 to 1,000, query filters on traces by status, duration, tokens, cost and time, and `evidence_resource` links for paging retained results (20). MCP errors carry a structured code, message, retryability and field details, and authentication failures are kept apart from workflow failures. REST validation errors include details (18). Stable `request_key` on paid and long-running operations with conflict on a changed payload, and every tool sets readOnlyHint, destructiveHint, idempotentHint and openWorldHint from its catalogue entry. Only two tools are marked destructive (20). Account connections must pass `project_id` on every project tool. One official SDK, Python, plus OpenTelemetry from any language and the OpenAI client for inference (8). 10+20+18+20+8 = 76.); Prefactor 88 (List calls take `pagination[page_size]` up to 100, summaries and counts are opt-in flags, and one endpoint exports a whole run's context (16 of 25). Offset pagination, sorting and filters by agent, instance, environment, time, purpose and status, with no cursor (18 of 20). Errors carry a stable `code`, a message naming the exceeded scope on 429 and a per-field map on validation failures (20). Every operation accepts `idempotency_key`, and a retried bulk request fails only the reused items. There is no MCP server to annotate (20). Official TypeScript and Python SDKs and a CLI. The Python SDK does not yet support sensitive encoding (14 of 15).)
- Payments & pricing, Prefactor +10: Overmind 30 (No x402 or other machine payment. Paid work spends prepaid credits, and `402` is documented only for insufficient credits (0). Plan prices, the credit rate ($0.01) and per-model "from" prices for training and serving are published without login (20). A Free plan with $50 of credits once exists, but neither the pricing page nor the docs say whether a card is needed, so half (10). A person signs up in a browser at console.overmindlab.ai. MCP OAuth with dynamic registration still needs a sign-in, and `create_api_key` needs an existing connection (0). Self-hosting under AGPL is free but runs on the operator's own Modal, OpenRouter, AWS and Hugging Face accounts, so it isn't scored as the hosted option. 0+20+10+0 = 30.); Prefactor 40 (No machine payment protocol (0). Per-span overage prices and plan prices are published without a login, $0.0025 a span and $49 or $199 a month (20). The Dev plan is free with 5,000 spans a month and the page says no credit card is required (20). A person signs in through the browser to create the first token. `POST /api_token` mints more only with an existing token (0).)
- Maintenance & community, Prefactor +6: Overmind 76 (overmind 0.1.115 on PyPI on 2026-10-31, and the last commit on main the same day (30). 41 PyPI releases since 21 September 2026 and 24 git tags from v0.0.15 on 18 September to v0.1.23 on 30 October (20). github.com answered 403 to this session, so issues and pull request replies weren't read. 172 commits on main from eight people since 15 September, a Discord server and a support email (8). One official SDK, Python, current with the platform (10). Public CI workflows for the platform and SDK, Dependabot bumps merged on 28 October and a CI badge. We couldn't see the pass state (8). 30+20+8+10+8 = 76.); Prefactor 82 (The site changelog's latest entry is 21 October 2026 and `@prefactor/cli` 0.6.1 was tagged on 28 October (30). Twelve changelog entries since 3 August, and releases of `@prefactor/cli` (0.2.2 to 0.6.1), `@prefactor/core` 1.2.0 (13 September) and `prefactor-core` (12 and 13 August) in the window (20). A closed service with a public changelog, a Slack community and public SDK repositories. Reply times per the 8 October check, not re-read on 1 November because GitHub's pages refuse our reader (9 of 15 available to a closed service). Current official SDKs in two languages (15). CI per the 8 October check, not re-read. It passed on the TypeScript main branch on 13 September with weekly scheduled runs passing to 8 October, the npm release workflow failed on 13 September, and the Python SDK's last release is 13 August, still the newest version bump in its repository on 1 November (8 of 10).)